CIO Cyber & Risk Network

A vendor independent forum to learn from and share with your peers

"I'd like to thank you for a fantastic discussion regarding cyber security, the discussion was facilitated very well."

The CIO Cyber & Risk Network Mandate:
To provide CIOs in Australian organisations with a forum in which to share their issues and approaches to cyber security and risk. The intended outcome is that organisations make better informed decisions to help protect their organisations, staff, customers and the economy.
Introduction
Not all Australian organisations are fortunate enough to have a Chief Information Security Officer. But not having a CISO doesn’t mean the challenge of managing cyber risk goes away. IBRS clients have been telling us that the frequency with which they are being asked to report on cyber security to their boards has increased. Now, four times a year is the minimum, and the board members are asking better, more in-depth, questions. The CIO Cyber and Risk Network is a vendor independent forum for CIOs to share with and learn from each other.

Benefits

  • Through interaction with your peers, gain an understanding of effective security practices.
  • Save time and effort by sharing policies, frameworks and security literature.
  • Discuss vendors and services from people who are using them or have moved on from them.
  • Discuss different approaches to security.
  • Raise ideas, challenges and solutions to the network of CIO's to provide their independent thoughts and advice.
Who Can Participate?
The CIO Cyber & Risk Network is a service for CIOs who are accountable for cyber security as part of their role. To ensure that trusted relationships can develop, and provide an experience of continuity within the group, CIOs invited to participate will not exceed 20 The CIO Cyber & Risk Network is an invitation only forum. This is to ensure that the forum is not swayed by vested interests, and that the participating CIOs are assured of the confidentiality of the discussion.

Format

  • Monthly video sessions
  • IBRS will facilitate each gathering.
  • IBRS will also coordinate any external guests.
  • All gatherings are closed door, and held under the Chatham House Rule.
  • A summary of findings is distributed after each gathering.
  • Participate in a distribution list of like minded CIOs.
  • Should a CIO not be available to attend a gathering, sending a direct report is possible but discouraged. If direct reports are sent too often, as determined by the group, the CIOs’ invitation to participate may be withdrawn and no refund will be offered.

Highlights

CIO Cyber & Risk Network December 2020
The Cyber and Risk Network December call focused on the following areas:
1. CPS 234 - supply chain assessment is a requirement of this standard. Suppliers should have a risk approach that supports an APRA regulated entity.
2. APRA speech - big 4 audit firms going to get involved as part of the independent third party assessment.
3. One of the call participants shared that they were considering doing darkweb monitoring on their suppliers because their security team want an early warning if one of the suppliers had been breached.
4. SOC-as-a-Service: one of the call participants gave a solid testimonial for https://expel.io/
5. One CIO shared that they had used red teams to test their third party SOC effectiveness.
6. Zero trust - the call participants discussed that a vital question is “what’s the problem we’re trying to solve?” It’s a series of good security approaches, but it relies on heavy business understanding, because a core potential weakness is in over provisioning access, because then you’re back at square one.
7. So, the real question around Zero Trust is; How do you redesign the stuff you have to achieve an outcome that works for your organisation?
8. The comparative benefits of Okta versus MS Authenticator and opportunities for OPEX reduction.
9. Comments from our CIOs:
- “We’re helping more of our suppliers with their incidents than our own.”
- “One person makes a mistake, another person feels the pain”
- “You certainly don’t need a product that says Zero Trust ™ on the front.”

Testimonials

"At the February gathering this year, the CIOs had one particular conversation about the new Australian mandatory breach notification scheme that saved me weeks of work and thousands of dollars. It's an important area for me and I got the value of the annual membership right there."
Global CIO
“Our first Cyber & Risk Network meeting justified the participation time and energy. Networking and experience sharing is critical in cyber risk management, and getting first hand feedback and input for phishing simulation tools allowed us to make a better solution choice.”
APRA regulated CIO
CIO Cyber & Risk Network Schedule

3 February 2021

CIO Cyber & Risk Network

To register your interest in the next CIO Cyber & Risk Network forum please complete the following form

Please let us know your name.
Please let us know your email address.
Please provide your company, or if personal, enter "Personal."
Invalid Input
Invalid Input
Invalid Input
Invalid Input